CVE-2026-13307

Executive Summary

CVE-2026-13307 (ZDI-CAN-29048) is a heap-based buffer overflow vulnerability in the USB packet handling subsystem of the Autel MaxiCharger AC Elite Home electric vehicle (EV) charging station. A physically present attacker with access to the device's USB port can trigger arbitrary code execution without authentication, achieving full compromise of the charger's firmware in the context of the device. The vulnerability carries a CVSS score of 6.8 (Medium) and affects all known firmware versions; no patch is currently available. Given that the attack requires physical presence (AV:P), the immediate risk is limited to scenarios where an attacker already has unsupervised access to a deployed charger, but the impact — full device compromise, charger manipulation, and potential grid-side attacks — warrants immediate attention from operators of Autel MaxiCharger units in residential, commercial, and fleet environments.

Technical Analysis

The vulnerability resides in the USB device handler of the Autel MaxiCharger AC Elite Home. The charger exposes a USB interface — typically used for firmware updates, configuration import/export, and diagnostics — that accepts vendor-specific control and bulk transfer requests. The specific flaw (ZDI-CAN-29048) lies in the absence of a length validation check before a memcpy or equivalent operation copies user-supplied data from a USB OUT transfer buffer into a heap-allocated destination buffer of fixed length.

The vulnerable code path is triggered when the device processes custom USB packets (vendor-specific requests, class requests, or bulk OUT transfers). The firmware parses a request header that includes a length field; however, it fails to verify that this length field does not exceed the size of the destination heap buffer. Consequently, an attacker can supply a length value larger than the allocated buffer, causing a classic heap overflow:

/* Vulnerable pseudo-code reconstruction */
void usb_handle_custom_packet(uint8_t *user_data, uint16_t length) {
    uint8_t *dst = (uint8_t *)malloc(0x100);   // 256-byte heap buffer
    // Missing: if (length > 0x100) return error;
    memcpy(dst, user_data, length);            // Heap overflow occurs here
    // ... process dst ...
}

The overflow is a straightforward "length not validated before copy" bug — no integer overflow, no off-by-one, no use-after-free. The attacker controls both the length and the content of the copied data, which simplifies exploitation. Heap grooming can be performed in the same USB session by sending a series of benign packets of controlled sizes to arrange the heap layout. The overflowed data can then overwrite adjacent heap metadata (e.g., fd/bk pointers in a dlmalloc-style allocator) or overwrite function pointers stored in heap-adjacent objects, leading to control-flow hijack.

Attack surface: the USB port is externally accessible on the charger's exterior housing. The protocol is vendor-specific and undocumented (not a standard USB CDC class), but the device accepts any crafted packet sent to its configured VID/PID endpoints without authentication. No cryptographic handshake or session token is required. The attack does not depend on the charger's network state — it works regardless of whether the charger is online, offline, or in a setup/wifi configuration mode.

Exploitation Scenarios

The following attack chain describes a realistic exploitation path. While no public PoC exists as of this report, the vulnerability class (heap overflow in USB stack) is well understood, and the steps below follow standard embedded-device exploitation methodology.

Scenario: Unsupervised Access to a Residential or Fleet Charger

1. Reconnaissance (Physical access): The attacker identifies a target Autel MaxiCharger AC Elite Home. Target identification is straightforward: the unit is labeled with the Autel logo and model name. The attacker verifies physical access to the USB port, typically located on the side or bottom of the chassis, accessible without tools. No network reconnaissance is required.

2. Device enumeration: The attacker connects a USB host (a laptop, Raspberry Pi, or custom USB gadget device) to the charger's USB port. The charger enumerates as a vendor-specific device. The attacker uses lsusb or Wireshark on usbmon to identify the device VID (0x0E8D is MediaTek, or a custom Autel VID) and PID, and then probes available endpoints. The custom USB protocol accepts vendor-specific control requests on endpoint 0 and bulk OUT transfers on an endpoint such as 0x02. The attacker evaluates that the target firmware version is vulnerable by observing the device descriptor's iProduct string or by sending a benign diagnostic request and checking response timing.

3. Heap grooming: The attacker sends a series of USB bulk transfers of controlled sizes (e.g., 16, 32, 64, 128, 200 bytes) with benign payloads to manipulate the heap layout. The goal is to place a sensitive heap object (e.g., a function pointer table used by the USB request dispatcher, or the chunk containing an object with a vtable pointer) immediately after a heap chunk that will be overflowed. The attacker observes response behavior to infer heap state.

4. Trigger/Weaponization: The attacker crafts a malicious USB packet with the following structure:

   • Header field: length = 0x200 (512 bytes) even though the destination buffer is 0x100 (256 bytes).
   • Payload: a ROP chain or shellcode stored in the overflowed region, followed by heap metadata overwrite data.
   • The attacker sends this packet as a single bulk OUT transfer to the vulnerable endpoint. The firmware parses the header, trusts the length field, and copies 512 bytes into the 256-byte heap buffer, corrupting the adjacent chunk.

5. Payload execution: The overflow overwrites either a function pointer in the dispatcher struct or the heap chunk metadata to achieve arbitrary write. In the typical dlmalloc scenario, a "top chunk" or "unsorted bin" attack yields a write-what-where primitive. The attacker leverages this to redirect the program counter to their ROP chain located in the overflowed buffer. The ROP chain executes the attacker's final stage — for example, a short ARM/Thumb shellcode that disables authentication, patches the firmware update verification routine, or establishes a reverse shell over the charger's Wi-Fi or Ethernet connection.

6. Post-exploitation: Once code execution is achieved, the attacker can:

   • Extract cryptographic keys and session tokens from flash memory.
   • Overwrite the firmware update signature check to install persistent, backdoored firmware.
   • Manipulate charging logic — set charge levels, disable thermal limits, or force charging during peak demand (damaging the battery or causing grid instability).
   • Use the compromised charger as a pivot into the home/enterprise network via its Wi-Fi/Ethernet interface.
   • Exfiltrate data such as user credentials, charging history, and Wi-Fi network passwords stored locally.

Alternative scenario — Insider threat: A malicious contractor, employee, or maintenance worker with legitimate access to the charger (e.g., during installation or servicing) performs the same attack in minutes, using a pre-compiled exploit on a USB device that looks like a standard service dongle. No special tools are needed beyond a common single-board computer.

Impact Assessment

CVSS breakdown: The vector is AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Score: 6.8, Medium). The physical access requirement (AV:P) lowers the score, but all other metrics are severe: no attack complexity, no privileges, no user interaction, and full compromise of confidentiality, integrity, and availability of the device.

Business impact:

• Charger operators (fleet, utilities, commercial sites): A compromised charger can be turned into a malicious node on the grid. An attacker with code execution can disable charging, cause overcurrent conditions, or manipulate power draw in a coordinated attack (potentially part of a larger botnet of compromised chargers) to destabilize local grid infrastructure.
• Home users: The charger stores Wi-Fi credentials and configuration data. An exploit yields network access to the home LAN, enabling lateral movement to other IoT devices, computers, and personal data. The attacker can also reprogram the charger to deliver dangerous charging profiles, creating a fire hazard.
• Autel (vendor): Reputational damage, legal liability, and forced recall/remediation costs.
• Supply chain: Because the charger is installed in residential and commercial settings, a compromised unit can serve as a physical attack platform for criminals (ransomware, data theft) or nation-state actors (critical infrastructure targeting).

Blast radius: The vulnerability affects every Autel MaxiCharger AC Elite Home unit currently deployed, as no patched firmware version exists. The attack requires physical presence, so the blast radius per exploited unit is limited to that device and its network, but a coordinated attacker who compromises many units (e.g., via a rogue technician) can aggregate impact. The CISA KEV does not list this CVE, and no known in-the-wild exploitation has been reported, but the attack surface will grow as EV adoption increases.

Detection Guidance

Sigma Rule

Detects suspicious USB device connections and vendor-specific control requests targeting EV charger class devices on Windows hosts, and anomalous lsusb/usbmon activity on Linux hosts.

title: Suspicious USB Activity Targeting Autel MaxiCharger
id: 0b1a4e2d-9f5c-4d11-8a2a-3c4781a0c9b4
status: experimental
description: Detects USB enumeration and bulk transfer patterns consistent with exploitation of CVE-2026-13307 on hosts connected to Autel MaxiCharger devices.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13307
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    product: windows
    category: driver_load
detection:
    selection_usb_autel:
        Image|contains:
            - 'Autel'
            - 'MaxiCharger'
        EventID: 20001   # Microsoft-Windows-Kernel-PnP/Configuration
    selection_vid_pid:
        - DeviceName|contains: 'VID_0E8D'  # Example VID
        - DeviceName|contains: 'VID_1234'  # Placeholder for Autel VID
    condition: selection_usb_autel or selection_vid_pid
level: medium
falsepositives:
    - Legitimate USB connection of a service dongle for firmware updates
tags:
    - attack.t1203
    - cve.2026-13307

YARA Rule

Detects USB capture files (pcapng/pcap) or memory dumps containing the unique packet header and overflow-length pattern characteristic of the exploit.

rule Autel_MaxiCharger_CVE_2026_13307 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects exploit artifacts for CVE-2026-13307 (heap buffer overflow in Autel MaxiCharger USB handling)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-13307"
        date = "2026-01-15"
        cve = "CVE-2026-13307"
    strings:
        // Magic bytes in the vendor-specific USB packet header
        $usb_magic = { 41 55 54 45 4C }   // "AUTEL"
        $lenfield_256 = { 00 01 00 00 }    // length field = 0x000100
        $lenfield_512 = { 00 02 00 00 }    // length field = 0x000200
        $payload_pattern = { 90 90 90 90 } // NOP sled / padding pattern (example)
    condition:
        all of them
}

Suricata IDS Rule

Detects USB over IP (usbip) traffic or network traffic from a compromised charger to a C2 server. Since the initial exploit is physical, this rule targets post-exploitation network activity.

alert tcp any any -> any any (msg:"Autel MaxiCharger C2 Beacon - CVE-2026-13307 Post-Exploitation"; flow:established,to_server; content:"Autel"; nocase; depth:20; content:"|0d 0a|"; within:200; pcre:"/Autel[^\r\n]{0,100}/i"; classtype:trojan-activity; sid:20260101; rev:1;)

Elastic Detection

EQL query to detect anomalous processes spawned on a host after a USB device with Autel characteristics is connected.

sequence by host.name with maxspan=10m
  [ any where true // USB device connection event (plugin: system)
      // Example filter for Windows system event ID 20003 - USB device connected
      event.action : "Device connect" and winlog.event_id : 20003 and
      // Match on device description or hardware ID containing Autel
      (message : "*Autel*" or message : "*VID_0E8D*" or message : "*MaxiCharger*")
  ]
  [ process where true
      // Spawned process after USB connection (e.g., exploit tool, reverse shell)
      process.executable : ("*bash*", "*cmd.exe*", "*python*", "*nc*", "*meterpreter*") and
      process.parent.name : ("*systemd*", "*services.exe*", "*Wininit.exe*")
  ]

Splunk SPL Query

Splunk query to correlate USB device connection logs with subsequent unusual network connections.

index=windows EventCode=20003 "Autel" OR "MaxiCharger" OR "VID_0E8D"
| eval phase="usb_connect"
| append [
    search index=network sourcetype=stream:http OR sourcetype=bro:conn
    | where dest_port > 1024
    | eval phase="network_conn"
]
| transaction host maxspan=15m
| where phase="usb_connect" AND phase="network_conn"
| stats count by host, src_ip, dest_ip, phase
| where count > 5

Wazuh OSSEC Rule

Wazuh XML rule to alert on USB device insertion of an Autel device and any subsequent command execution or privilege escalation.

<group name="autel_charger,">
    <rule id="100201" level="7">
        <if_sid>530</if_sid>  <!-- Base rule for USB insertion (Linux) -->
        <match>Autel|MaxiCharger|VID_0E8D</match>
        <description>Autel MaxiCharger USB device connected. Possible CVE-2026-13307 target.</description>
        <group>usb,autel,</group>
    </rule>

    <rule id="100202" level="10" frequency="3" timeframe="60">
        <if_matched_sid>100201</if_matched_sid>
        <regex>bash|sh|nc |/bin|python|perl|wget|curl</regex>
        <description>Malicious activity detected following Autel charger USB connection. Possible exploitation of CVE-2026-13307.</description>
        <group>usb,autel,exploitation,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source (no vendor advisory, no firmware update, no CVE fix commit). The vendor (Autel) has not publicly acknowledged the vulnerability or provided a remediation timeline as of this report. The CVE entry does not specify any affected versions or a fixed version.

Immediate mitigations (until a patch is available):

1. Physical access control: Restrict physical access to the charger's USB port. Install the charger in a locked enclosure, or apply a tamper-evident epoxy or plug seal over the USB port. For fleet/commercial installations, ensure chargers are located within monitored, access-controlled areas.
2. Port disabling (if supported): Check if the charger's configuration interface (mobile app, OCPP backend) supports disabling the USB port or restricting it to a signed firmware-update mode. If available, disable the USB port entirely if not required for normal operation.
3. Network segmentation: Ensure the charger's network connection (Wi-Fi/Ethernet) is isolated from critical corporate or home networks. Use a separate VLAN and restrict outbound traffic to required OCPP endpoints (e.g., charger management server) using a firewall.
4. Monitor USB activity: Deploy USB device monitoring on any connected management hosts (e.g., a laptop used for diagnostics). If the charger is networked, monitor for unusual traffic patterns originating from the charger's IP.
5. Firmware integrity checks: Regularly inspect the charger's firmware version and configuration through the vendor's management console. If any tampering is suspected, immediately isolate the device and perform a factory reset via a trusted method (if available).

Patch/upgrade steps: None available at this time. The only remediation is to await a vendor firmware update. Continuous monitoring of the vendor's security advisories page (Autel Energy) and the ZDI advisory page for ZDI-CAN-29048 is recommended. When a patch is released, apply it immediately to all affected units.

Long-term hardening:

• Require vendor authentication on all USB requests (e.g., signed challenge-response).
• Add proper length validation for all incoming USB buffers.
• Implement exploit mitigations in firmware: ASLR, non-executable stack/heap (XN), stack canaries, and heap integrity checks.
• For organizations operating large fleets, establish a regular firmware patching cadence and physical security audit process.
• Monitor ICS-CERT and CISA announcements for updates on this and related EV charging infrastructure vulnerabilities.

References

1. NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13307
2. ZDI Advisory (ZDI-CAN-29048): https://www.zerodayinitiative.com/advisories/upcoming/ (search for ZDI-CAN-29048 when published)
3. Autel Energy Security/Support Page: https://www.autelenergy.com/us/support/ (monitor for future advisory)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-13307 is NOT currently listed)
5. First.org CVSS Calculator for verification: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Additional notes: This CVE was reported by a researcher through the ZDI program. As of this report, there is no evidence of exploitation in the wild, no public PoC, and no known threat-actor campaigns targeting this vulnerability. The EPSS score is 0.00344 (27.0th percentile), indicating a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Operators should treat this as a latent but serious physical attack vector and prioritize mitigation accordingly.